Getting Events from Network Devices
What protocol does LEM use to get logs from routers, switches, and other network devices?
View ArticleClik here to view.
Re: Not able to add Cisco IPS node on LEM
i saw an issue that when i connect IPS with IPS Manager after apply credentials on IPS manager it prompt me to accept certificate that was generated by IPS , is there any way to accept IPS certificate...
View ArticleRe: Getting Events from Network Devices
Hi Cassandra, Typically speaking, LEM receives logs from network devices via syslog on Port 514, using TCP/UDP. If you need advice on how to configure a particular device/LEM connector let me know.
View ArticleServer Disk C monitoring - Alert
What is the best and easiest way to setup a rule to get an alert on any server disk C used up to 75%? I do have it setup for LEM appliance with heartbeat but not sure how to get all our servers...
View ArticleClik here to view.
Re: Server Disk C monitoring - Alert
I do ours like this: For your case, you would want to build a servers group and apply it to that.
View ArticleClik here to view.
Re: Server Disk C monitoring - Alert
The thing to keep in mind is that windows event id that LEM is looking for for disk space alerts is set up at the operating system level, the default being at 10% free space remaining. To change the...
View ArticleRe: Not able to add Cisco IPS node on LEM
It appears this is an issue with the 7.0 IPS software. It also appears that Cisco is at least up to 7.3 as of 2015. Release Notes for Cisco Intrusion Prevention System 7.3(2)E4 - Cisco Can you update...
View ArticleLEM nodes don't delete
Recently updated our LEM to 6.2.1.We are seeing nodes that have been retired, but still on the network. We delete them butthey magically return. Anyone know how to fix this behavior? Thanks,Ken T.
View ArticleLEM Not On DHS CDM Product Catalog List! Why Not?
I work for a federal agency, and we are being directed to utilize tools off of the new Homeland Security Continuous Diagnostics & Mitigation (CDM) product catalog, and while I see SolarWinds NCM...
View ArticleRe: LEM nodes don't delete
Are these Agent or syslog nodes? If Agents, that suggests they're still on and trying to connect somewhere. If syslog, has something else claimed the same IP and sent logs to LEM? If you search for the...
View ArticleRe: LEM Not On DHS CDM Product Catalog List! Why Not?
I know that 6.3 (currently in RC) is supposed to address some short-comings in LEM that may impact NIST compliance, especially as it relates to CAC requirements. It may be that they haven't...
View ArticleRe: LEM Not On DHS CDM Product Catalog List! Why Not?
Thanks curtsi. I've used Splunk (and the rest of them) and LEM is by and large a dominant product, so it has every reason to be on that list. If you need any additional documentation on the specs and...
View ArticleLEM Hardening
Dear All We are running LEM 6.2.1 in our environment. IS team has run the internal vulnerability scanner in which we have found many vulnerabilities in LEM VM. Can any one guide us how to fix that...
View ArticleClik here to view.
Does not equal filtering question
I want to see all the executables run in the user's home directory. I can see that information with the ProcessStart.ExtraneousInfo *C:\Users* but when I try to filter out all of the usual executables...
View ArticleRe: LEM Not On DHS CDM Product Catalog List! Why Not?
Good news! We did get LEM on the CDM product guide during the last phase. Please see page 20 of the approved list, item 233:...
View ArticleClik here to view.
Re: LEM Hardening
The LEM is an appliance, so there's no maintenance to do. However, 6.3 (currently in RC) does address a lot of the new vulnerabilities.
View ArticleClik here to view.
Re: Does not equal filtering question
While it seems like your logic should work, I was able to reproduce this in my environment. To get it to work, move all of the not equals statements into a separate group as such: Logically, you...
View ArticleClik here to view.
Re: Does not equal filtering question
That seems to have worked... odd but working. Thanks buddy!
View ArticleUnable to get E-Mails. How can I temporarily get the notifications from a Rule?
We are going through an e-mail migration and there has been some issues arise with the e-mails coming from the Solarwinds LEM product. I was just wondering if there is another way I can get that...
View Articlendepth query
new to SW LEM and trying to figure out a way to drill into a file server from a few weeks ago, I'm trying to use nDepth from console and pick criteria correctly. is there a max of how far back I can...
View Article